Index

2026-09-13_72fc74d16dafc8601844ee5af9c90463_cryptolocker_elex Sep 14

9a809c4fe331dce2840d4de60243b83aebbc86e87c8e4b11c05a0716b79b58a9 ✓ Th

100% CryptoLocker ransomware variant

804701959A1DBFBBFC6D8142DE850DB9FCE9A611 Sep 14

684f863b5af69ef3dc4e86a54cbb1f5486adfe79e08bd0b12d89684c0a9fb2fe Th

100% GIF header anomaly suggests obfuscation

1DF9B4DC693CE7250F51CBC7CED53AD0A6E1C587 Sep 14

79bc1595ad701ab8a72874a96bcfb94986daeee26b996241e691f3d53f7ec53a Th

100% GIF header anomaly suggests obfuscation

6CF8CA847EE317255A9084BB44AE3F38EF61E5C3 Sep 14

f4698d9429b004357d1008ea8c9b94ec2a0370900616165db2315a9cbdda28fd Th

100% GIF header anomaly suggests obfuscation

K8data.mdb Sep 14

454a3fc187e49457208fa7a16de93098840e7fcb687015b722fabd2757b720f3 Th

90% AutoIT script, unusual context

2b1835ca87b77f77bedb96c5cef93298bcacdb1ca4ca51b8923338284f813ed5.bin Sep 13

2b1835ca87b77f77bedb96c5cef93298bcacdb1ca4ca51b8923338284f813ed5 ✓ Th

99% trojan/mirai

2026-09-13_c89cff4699750c380c95ea8323c5afcb_cryptolocker_elex Sep 13

c45b5ee7bee7abd3daf191185cf4b1aae8fb06ce26ce44f0082b788e5ec78c56 ✓ Th

Cryptolocker/Rule2

2026-09-13_a924432e41dd943876fe176e35db4b77_cryptolocker_elex Sep 13

28b60f0c915371f46a8c1b0a00a7a2bf0b58315f567775f2436eba3b1d0b42e3 ✓ Th

100% CryptoLocker ransomware variant

github.com/craftedsignal/sigma-parser v0.1.1 Sep 13 go

e55a5ee96737ee7e69af96d21bd77c584f7e35f1cd2c72574a0577563a6b0ec0 ✓ Th

In/FilePatterns/Dec21

rev.sh Sep 12

b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b ✓ Th

Shellpop/Bash

github.com/metalagman/ddgo v0.1.0 Sep 12 go

17fcd92cdc9d7c715927f7d79763950d788b02e11ec54fe504e5aedcfdae8055 ✓ Th

64% Security tool test fixtures

github.com/metalagman/ddgo v0.2.0 Sep 12 go

60acbfa065583ab3348f2fc640845b69542df1fc741c1098ab21179fc437892f ✓ Th

64% Security tool test fixtures

github.com/archbottle/dd2 v1.2.0 Sep 12 go

25fddcd66dff91d1060202034e2126df8900e73d23db111b5fade44fda2ca1fb ✓ Th

Dec21/Soft

@wumx-labs/noxaeapi-cli 2.0.1 Interactive terminal client for the NoxAeApi SDK, by wumx Sep 12 javascript

7fd439fa377fd458003602021c9234100d35a65838ae8d1184e3e98a62fab13e Th

Trojan.Acad.Bursted.a Sep 12

b963d8a0b75106a5bb5bece87ebce57995b8c0d8e58fb5ee837dde07c57d2a22 Th

100% malicious AutoCAD infector

Virus.Acad.Bursted.a Sep 12

0a286f676c0d83bd89cbce58b2e6fc914a967539b02734f56a26704a04b3769b Th

100% Autocad virus propagation code

Backdoor.ASP.FileUpload.a Sep 12

4ef09e34ce7425e17912f3e24c99ae0aae74e8098775d1567a4f98933ba9bec3 Th

100% Encoded ASP webshell backdoor

Trojan-Downloader.JS.Agent.crj Sep 12

d1ad827e66ec7d35d928d756d1258a149b02c451137b66411bfa0152997c62e0 Th

98% PHP webshell with command execution

Backdoor.PHP.Exploiter.a Sep 12

2a0dc0e5e4ef9ed7420c17a986978feb2f187b50439b6aa453ab8d039cf6370d Th

100% Known PHP webshell backdoor

Backdoor.PHP.Lanker.a Sep 12

97f7668d00fd22110e67c83790d24d7783e812ed339f28a0f7eb308dc75b3377 Th

100% PHP webshell backdoor

Trojan.PHP.Agent.a Sep 12

064873ba920b1dabda02fdda782725bb9cc3920e5a1c08797803644665aa8ee0 Th

100% PHP webshell in GIF

Backdoor.PHP.Small.o Sep 12

846e0d9fffaf41f2509ca3b8e3335d63cfbc55d44071f8c865806ebd5280b4d5 Th

W4Cking/Xxx

Trojan-Spy.PHP.PhPen.d Sep 12

4a7d1f4ecb206b5c1aa5c5f0ab8a40dba546b80d56b5279943afea61ec4cf5ab Th

97% PHP web shell detected

Backdoor.PHP.Agent.bs Sep 12

574ecafef28f2cca7e4e0e861f1bce02820c12ae0d0f2165fa76e8790b87ed9c Th

100% PHP webshell backdoor

Backdoor.PHP.WebShell.a Sep 12

f6cd35d36c440c9922e725554ef52c7acbaf44a3cc1f8d6804eead0c96083b4b Th

100% PHP/GenericLite/PHPSPY

Trojan.WinREG.Teserv.a Sep 12

c9f23dcec62b17a5c7ca9cdbf042fe8374b85c93192b690839e528e1281b2326 Th

100% Enables RDP, deletes evidence

Virus.ALS.Bursted.a Sep 12

fe69315ad20428a0627c9b3eb93b9288f7e70b2a3c8e3b6d08803281a5e80b28 Th

100% Autocad virus propagation code

Virus.VBS.Valium.a Sep 12

5e225649f1b22df45eb21cfeeac0849171af2b254d09676eac202d0d57c100a7 Th

75% Case/Anomaly

Virus.MSExcel.Sic Sep 12

69b13a5299f6a53ca34ea295cfd2f8b4fed452e29163d1c50a79e453270fa381 Th

100% Excel macro virus

Trojan-Downloader.PIF.Agent.b Sep 12

dd716d490b856b431069bcb088586901f62cccd2a98f95ec398c1514beb145e7 Th

Backdoor.Win32.Bifrose.ypf Sep 12

6a8d7f8020d336021170ef09a8379008f7fa51490fda1cb754fdbc108701c123 Th

100% Known Bifrose backdoor

Backdoor.Win32.Agent.hwt Sep 12

b8a6d1a69c7887fda34747928693d9c8c6c2c9809c50822cc26c1bed3c5b449c Th

100% Nitol malware signature detected

Backdoor.Win32.Hupigon.dpwa Sep 12

86a7378b6751d27969541064a2ac83da480e717130ce47c0d181bccf56079e00 Th

String/Transforms

Backdoor.Win32.Bifrose.sy Sep 12

25fce28d134791bce5a3c0c1b5744445c20ae6008cc9d2a10f4f1d98eed5d037 Th

1609/A

Backdoor.Win32.Poison.inw Sep 12

b9f41c549447b961c0ebe1b79fa0a4814935f3aeec5e5cfb72bf0432a5fee1db Th

100% Named backdoor, malicious PE

Backdoor.Win32.Poison.jrv Sep 12

4a2aa5633acb8c18cc63f517baf7172fe9f04ff4d305855d8afaf42201d882fb Th

100% Poison Ivy backdoor detected

Backdoor.Win32.PcClient.azw Sep 12

17e69cc1c367eddcbf36a390c0c653475a29d776f22b2938dcb84bb5f6a7d611 Th

SigBase/Iisputscannesr

Backdoor.Win32.Poison.gup Sep 12

8470d23b74d51b18fb26b79cfde60e0deaf580a06813c58ad06fcb86fa7a759d Th

100% Poison Ivy backdoor detected

Backdoor.Win32.Poison.eiv Sep 12

d33bcbe274de2eef6f68e70c8b68fdd32abf6aff71b036a67606a4042a159ec4 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Poison.bmf Sep 12

c70df7eba04ed9dfbe9d288ed77c26e7458bdcc20d54149507de6ee0543de972 Th

100% Known backdoor signature

Backdoor.Win32.Poison.soq Sep 12

94b551ac45c630261e99278e173902a0cffdf892ddb5efd7ba83e35c7962f160 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Poison.bic Sep 12

59156a69568b0faa6914a2c18f956370cfac2fa15949693f79b4daea576af5b0 Th

Honker/Webshell

Backdoor.Win32.Hupigon.cpzz Sep 12

e03d00812cc9f011a17a3840857b85e9c8b4232bc2b8e82c1da33a77a7f708e6 Th

SigBase/Iisputscannesr

Backdoor.Win32.Poison.nlc Sep 12

8ab3ff58c76db6f933b7dbb56bab57448ba16c1535d01eb2e5c2f8aa99fced37 Th

100% Named backdoor, malicious signature

Backdoor.Win32.Hupigon.igq Sep 12

357fafd65a2a1ef29578f3bcd0f78343e1cced07454993075ad6ff0319e2357a Th

100% Known backdoor malware

Backdoor.Win32.Poison.jsa Sep 12

415338add16f9d59457e5ace59449e7625866c37b3d2ec648d7b644e548d1b50 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.VB.eoa Sep 12

990b1a3a78adebb9132d5390059e9f3204d56acda082f6c09da3c3971aa16347 Th

Base64/EXE

Backdoor.Win32.Ceckno.brw Sep 12

f4c7cb5578a89f28adf60d63e965b8adc11e32ce00037cac1272becccee68617 Th

100% Named backdoor, Nitol signature

Backdoor.Win32.Poison.spv Sep 12

3f63cd6f69de9338e079edaff91c14cb9e828142ca6ac4fe75272ac93739a99f Th

100% Poison Ivy backdoor detected

Backdoor.Win32.Poison.dvv Sep 12

44fad915d24d2439e850f8a043309c62189726cf5175cf16751166f990cb1889 Th

100% Known backdoor signature

Backdoor.Win32.Prorat.asy Sep 12

84e84afcc2dfd743a3856ed818c7cc7540efa0fca511bac20a0d78f4db17de8b Th

100% Named backdoor, webshell, pentest tool

Backdoor.Win32.Poison.bid Sep 12

0e03b5fd2df77d4fef846814ad9671e580e6bbd1b0d4b24c4e56f3d45f47baaa Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Poison.dqq Sep 12

f050cb09e3ff1fb78dce1d23a6841772ea78d3f5d88ffbe97e430848d967320c Th

100% Poison Ivy backdoor detected

Backdoor.Win32.PcClient.jaf Sep 12

ce58df4d2650f37d7c3c1217d38c6b0a0f4357daf017619565fc6535366aeee0 Th

Update/Pcmain

Backdoor.Win32.PcClient.aiu Sep 12

2b61a7b9d6f304de218b1b1aec3d16cbd9226abebff52d05276b04611f6d7fb7 Th

100% Known backdoor malware

Backdoor.Win32.Bifrose.xdn Sep 12

87ddcbb2ad9049e3b542e3c4768e9f0c14dd93524e4fbcdb9ef5c009fedf79c9 Th

Honker/Webshell

Backdoor.Win32.Agent.jxp Sep 12

2610f64fec2beeac73e10e9eea22dcd831e81e61bf9714d7b93c6881baa7ecdf Th

Backdoor.Win32.Small.eat Sep 12

cce1cae50f69845ecec8042afb81e19906459a1b9ac1580d87d8255a9b500cd7 Th

Malware/Jan19

Backdoor.Win32.Rbot.pnk Sep 12

21815b3ad2b98a3de26d0a4acbd5d71556ab9dbfe5a67f50fa0e2ee69048c926 Th

Honker/Webshell

Backdoor.Win32.Bifrose.dsg Sep 12

1e0d6319b2cdc856d964dec617ab9c8d0eea98f08a92217430e150cd3b5fdc01 Th

100% Named Bifrose backdoor

Backdoor.Win32.PcClient.hgr Sep 12

253fe498fa4fcf9e2cabf1a96358a4e0938c635d1a91952c7cc8379ab4bcc618 Th

100% Known backdoor malware

Backdoor.Win32.Bifrose.you Sep 12

d6417a514b79668508ee5efb54a22f2126376e521cdcbf71a7f87b7db7963ce7 Th

Base64/EXE

Backdoor.Win32.EggDrop.130 Sep 12

3e8b46b3929e1b544bdbefb5053daea17ed9e0eeb5e235e8c3153f0e4857bc80 Th

100% Known EggDrop backdoor malware

Backdoor.Win32.Poison.cyp Sep 12

f641d58fcac3306fd734d6915bf9018ee5b7b215506c138592a2d7dbc33f0030 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Ceckno.ayf Sep 12

f80b9d74f359c461c33a0d0d55c2db3d3299cab5dbe28b899aacfa65782616f9 Th

100% Named backdoor, embedded PE

Backdoor.Win32.Poison.ehb Sep 12

95e0275abdb88d1334dc95cd06072f959fa0ac5eb6612ebfc027fdf53d766bbc Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Bifrose.abke Sep 12

79d269e7bb9146206ef68c37324f34eb9292473df013c23e46c2249abae7b07b Th

100% Named Bifrose backdoor

Backdoor.Win32.Poison.srm Sep 12

e48726acf0e8d6b47e564b9f49be2d758ae0e0f028bf34e0bde0bbb762b53f88 Th

100% Poison Ivy backdoor detected

Backdoor.Win32.PcClient.pig Sep 12

9b8d33178fd02a45d36b6958d6626b0540f9ec3718ec29c6cffb24327a7f00e2 Th

Update/Pcmain

Backdoor.Win32.Bifrose.alqk Sep 12

55a16ac13628f3ece87f75344624fd31ca9e3eb88c3b1028ac1175cdcf17f725 Th

EXE/Sandboxproductid

Backdoor.Win32.Rbot.cin Sep 12

037e1df212fbfc6c77ea55754f52b11366da8e0fd5437834762339a30e705614 Th

Honker/Webshell

Backdoor.Win32.Bifrose.thc Sep 12

7fd1d09a4db61516454e11d886ba46671641fdb637e66c379fedf722d6e09ffa Th

38% Base64/EXE

Backdoor.Win32.Hupigon.apq Sep 12

d098fc50c3415e5a6022fa8423a99fc71d52db2d10ee45fc08985b9781bc7f3a Th

100% Known backdoor malware

Backdoor.Win32.Poison.jke Sep 12

846440640f35f80dd0e54247dbf4c2578f8a152d0d4c7a7ba198a877f2c64388 Th

100% Poison Ivy backdoor detected

Backdoor.Win32.Ceckno.bmy Sep 12

7aa9a83579ec0e878bc32bf14bee641507e7473c14362efd46257f7d421d5e7a Th

100% Named backdoor, network strings

Backdoor.Win32.Poison.eui Sep 12

c1092f40287dd9ffad564f30e80162ff8a4b5c751d3f94848380d6832024e6c4 Th

100% Known backdoor signature

Backdoor.Win32.Rbot.jis Sep 12

dce25c84db23dd6622adb5b1ca8c9585dd6b4ed516e96ec5c393148526a1c1d3 Th

Honker/Webshell

Backdoor.Win32.Agent.aaw Sep 12

8d19834dc8c6ed560d921e966e657ff283518c7326767bd3812ae837240959e7 Th

100% Named backdoor, hacktool set

Backdoor.Win32.Poison.nbz Sep 12

ce569ffa6979ec8f1609014e285e55a901b3870bc8760500d91ae9b810c550cb Th

100% Poison Ivy backdoor detected

Backdoor.Win32.Ciadoor.cq Sep 12

539b21da514b7fc21cf41eac4164dad4ab1b09a132dc1ecbb34637ce15c65083 Th

Base64/EXE

Backdoor.Win32.SdBot.dxe Sep 12

3c3957b07a96a8074e8bf78eb7d51243f11a618f081a750c8a1915306086ce0d Th

100% Named SdBot backdoor

Backdoor.Win32.SdBot.ejp Sep 12

5e6174e358688f7b1be26fe5d7944f2a763140bcdeb9d3bd0f4ec978278709c2 Th

100% Named SdBot backdoor

Backdoor.Win32.Bandok.ej Sep 12

8476a8903372220315a1000628415a445775c5d6af043e0b8e57cecb64ce6ccc Th

Backdoor.Win32.Poison.jkb Sep 12

8484d22f72aa59c2e7d6afacc0ad05edf33056f8d104b591ae20c0ee19dafa61 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Poison.dmd Sep 12

70acf70e569ae47e4d54ba0fa5bfe170ea46ececcde9773e8466ad552504c3bf Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Agent.hxw Sep 12

53b1d97b7939ae4d9d80c224aaa586eac52aa79cddefbea75bbe4d99974e64fc Th

Malware/Jan19

Backdoor.Win32.Poison.hkr Sep 12

e054196aa611c9944b42c8c338f47e2b9b06724aec6b885d84f11af0652ea9d6 Th

100% Poison Ivy backdoor signature

Backdoor.Win32.PcClient.gyw Sep 12

2465a5c6eeeac659f9a79c24e4f64eb704e5074c7786f9e813cbce2b3c276d40 Th

Update/Pcmain

Backdoor.Win32.Poison.ldc Sep 12

9a246e698694816a9552c58e4fbf66fdd5ed036bfcf82f3446f44b4029e452e4 Th

100% Known backdoor signature

Backdoor.Win32.Poison.dau Sep 12

9377384ce19a14abbe3d07cd24363d2dc8c764b79151b0d7c695508689a00154 Th

100% Poison Ivy backdoor payload

Backdoor.Win32.Poison.oxt Sep 12

3a2290787ee5f027f00f8731b3636857b183123f1ca6d7b000f8444977c2b0d9 Th

100% Known PoisonIvy backdoor

Backdoor.Win32.Hupigon.cnng Sep 12

f67486ca8016a3a49beb42c479f1961d57d5a777609b1bd2728a136d7e52247e Th

100% Known Hupigon backdoor malware

Backdoor.Win32.Nytroloh.dq Sep 12

6898a2d25f6e3b7add2ad66692720e27acde0c2c8e283516c7ad7d3a765bedb0 Th

100% Known backdoor malware

Backdoor.Win32.Poison.hcz Sep 12

d5677682c9eb346cd1bed882e4658a233d8d8c082102cdfbdfb29b890bce15dc Th

100% Named backdoor, malicious signature

Backdoor.Win32.Agent.avx Sep 12

1d4a71e380c3017f7eed942f6efe135246348ba80a5bdcf1977f3377db0adbec Th

Malware/Jan19

Backdoor.Win32.Httpbot.hi Sep 12

4d9b7dc5198011a47f61ff69b0f662e16613bcd37f9d4344e0ebf195d56ca600 Th

100% Named backdoor, malware strings

Backdoor.Win32.Poison.cgr Sep 12

a19f6967399ec3ad5cb1bddd176c70e277ba9bb90976e84210193e46a7656295 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Hupigon.ceue Sep 12

6d69c6b8bce9ad9c6eb1a64a2693ee14573fb4680b900957bb6dd1b7d741cc7e Th

100% Known Hupigon backdoor malware

Backdoor.Win32.Poison.tfa Sep 12

b5d5bb6c691120d135f321532d7aca86930c3a90ab648de51d4c398a46abc476 Th

JPCERT/Poisonivypoisonivy/poisonivy

Backdoor.Win32.Poison.guh Sep 12

584aeb4c1d12b06b46c467fa07ec89a6a4b56fcca72b49b7bea395944658a505 Th

100% Poison Ivy backdoor detected